Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

What it is

CVE-2026-76504 is a critical (CVSSv3.1 9.8) unauthenticated API authentication bypass in Cisco Catalyst SD-WAN Manager, caused by improper URL-encoding handling (CWE-177) in the authentication rule guarding a specific API endpoint. Cisco published the advisory September 30, 2026; Cisco PSIRT learned of active exploitation in September 2026.

How it works

A remote, unauthenticated attacker sends a crafted HTTP request in which a single character is URI-encoded — Cisco's example encodes j in j_security_check as %6a_security_check. This encoding causes the request to slip past the authentication rule for that endpoint, granting the attacker API access with admin-user privileges. Cisco states any single character in the request can be encoded this way, not just the example character.

Preconditions / Affected

On-premises Cisco Catalyst SD-WAN Manager instances with management ports exposed to the internet are at risk; the flaw exists regardless of system configuration otherwise. The cloud-based Cisco SD-WAN Cloud (Cisco Managed) offering is already fixed in release 20.15.605, and Cisco states no customer action is needed there.

What to do

• Upgrade on-premises Catalyst SD-WAN Manager to a fixed release immediately, outside normal patch cycles — no workaround exists.
• As a temporary measure only (not a substitute for patching), block access from unsecured networks; if internet access is required, restrict to known trusted hosts behind a filtering device.
• Added to CISA KEV on October 1, 2026 with a remediation deadline of October 3, 2026 — a two-day window from listing.
• Audit for compromise by reviewing:
• /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests containing an encoded character, e.g. POST /%6a_security_check HTTP/1.1
• /var/log/nms/vmanage-server.log for j_security_check requests tied to usernames starting with viptela-reserved-
• If compromise is suspected, Cisco customers can open a Severity 3 TAC case (CVE-2026-76504 in the title) with an admin-tech file generated via request admin-tech.
• Rapid7 Exposure Command, Vulnerability Management, and Nexpose checks were expected in the October 1 content release.

Caveats

Cisco itself cautions that these log patterns (encoded characters in j_security_check, viptela-reserved- usernames) can also appear during normal operation, so hits must be evaluated against baseline network behavior to avoid false positives. This is the third unauthenticated auth-bypass disclosed for Catalyst SD-WAN in 2026 (after CVE-2026-20127 and CVE-2026-20182 in the vdaemon/peering stack), but Rapid7 states CVE-2026-76504 targets a separate API authentication path — the two are not the same bug recurring.